Local MCP

[Material-Scientist]

Hi,
I have an MCP server that's reachable under:

• https://n8n.service.consul/mcp/8cc2af19-111a-45a5-a282-1548f1ea2892
• http://n8n.virtual.consul/mcp/8cc2af19-111a-45a5-a282-1548f1ea2892

The first one is via self-signed certificate, and the 2nd is via Consul Connect service mesh (mTLS, as indicated via virtual.consul). Both connect to the same service, but the https one has 2 extra hops via ingress & traefik, whereas the virtual.consul addressing is http inside the container, and mTLS between the services and doesn't require connecting via ingress/traefik (just 1 proxy hop).

Service intentions are already enabled between the services.

Now, chat-ui apparently doesn't allow http when configuring an MCP server:

And the https url doesn't work either bc it's self-signed:

HTTP transport failed: fetch failed; SSE fallback failed: SSE error: TypeError: fetch failed: unable to verify the first certificate

I've already tried providing the certs via env vars:

task "chat_ui" {
      driver = "docker"
      config {
        image = "ghcr.io/huggingface/chat-ui-db:latest" # latest
        volumes = [
          "local/ca.pem:/etc/chatui/ca.pem",
          "local/cert.pem:/etc/chatui/cert.pem",
          "local/key.pem:/etc/chatui/key.pem",
        ]
      }
      template {
        data = "{{ key \"config/certs/ca.pem\" }}"
        destination = "local/ca.pem"
      }
      
      template {
        data = "{{ key \"config/certs/cert.pem\" }}"
        destination = "local/cert.pem"
      }
      
      template {
        data = "{{ key \"config/certs/key.pem\" }}"
        destination = "local/key.pem"
      }
      env {
        OPENAI_BASE_URL = "http://local-ai.virtual.consul/v1/"
        OPENAI_API_KEY  = ""
        USE_CLIENT_CERTIFICATE = "true"
        CERT_PATH = "/etc/chatui/cert.pem"
        KEY_PATH = "/etc/chatui/key.pem"
        CA_PATH = "/etc/chatui/ca.pem"
        USE_LOCAL_WEBSEARCH = "true"
        SEARXNG_QUERY_URL = "http://firecrawl-searxng.virtual.consul/search?q=<query>&format=json"
      }
      resources {
        cpu = 1024
        memory = 2048
        memory_max = 4096
      }
    }

But it's not working. I would rather avoid exposing my MCP server to the public just so I can use it here. Do you know how to make chat-ui accept the self-signed certs? Or better yet; is there a way to force the support of http, since it's clearly not insecure here (service-to-service comm is mTLS via service mesh)?

[gary149]

you mean on your own instance of chat-ui right? are you using latest release?
can you try starting chat-ui with NODE_EXTRA_CA_CERTS=/path/to/your/ca.pem so it trusts your self‑signed cert? http is not the issue it should work.

[Material-Scientist]

Yeah, the config shows image = "ghcr.io/huggingface/chat-ui-db:latest".

I made it work by hard-coding the MCP instead of setting it in the UI. But I ended up switching to Open WebUI.